Skip to content

Release Notes 2.0.0.97 Beta 1

Release history for the Automated Cryptography Discovery & Inventory (ACDI) Sniffer.

  • Version: 2.0.0.97.beta1
  • Release Date: July 27, 2026
  • Artifacts: Rocky Linux 8 RPMs for x86_64 and aarch64
  • Documentation Build: Static HTML generated with MkDocs Material

What's New

This release focuses on making offline telemetry more accurate and easier to consume downstream. It improves TLS handshake field naming, preserves unknown crypto states as Unknown, adds a field-level NDJSON schema reference, and introduces a reproducible SBOM workflow for release artifacts.

TLS and PQC Detection

  • Speculative TLS ClientHello parsing is stricter, so non-ClientHello TLS records no longer trigger premature handshake analysis.
  • Unknown or unmapped TLS selected cipher suites now produce Unknown quantum safety instead of being treated as known vulnerable crypto.
  • Unknown or unmapped TLS key-share groups now produce Unknown KEX safety and overall pqc.quantum_safety.
  • TLS 1.2 ECS output now falls back to the legacy ServerHello version when selected_version is not present.
  • TLS version labels now use dashboard-compatible values: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, and Unknown.
  • Legacy TLS supported-group and signature-algorithm codepoints are translated to human-readable names when known.

Offline Output Behavior

  • Plain HTTP records can be emitted before TCP close once request and response payloads have both been observed.
  • Generic non-TLS records are written only when the application protocol is known.
  • Unknown plain traffic, including unclassified plain DNS/UDP, may be skipped intentionally to keep offline output focused on crypto and protocol telemetry.
  • NDJSON output documentation now includes a field-by-field schema reference for Dashboard and ingestion consumers.

SBOM and Release Automation

  • Added CycloneDX 1.6 SBOM generation for RPM artifacts.
  • Added runtime OS dependency SBOM generation by installing each RPM into a clean Rocky Linux 8 runtime image.

Service Deployment

  • The packaged systemd unit now runs with WorkingDirectory=/etc/pqc-sniffer.
  • Service deployment documentation now calls out the working directory and offline-mode deployment expectations.

Output and Schema Notes

The new NDJSON Schema Reference documents:

  • source.ip, source.port, destination.ip, and destination.port for top-talkers and conversation grouping.
  • pqc.handshake.key_exchange_algorithm and TLS key-share details for KEX-oriented dashboards.
  • pqc.quantum_safety values, including the circumstances that produce Unknown.
  • TLS ClientHello supported groups and signature algorithms, including name translation and hex fallback behavior.

SBOM Deliverables

The release SBOM set contains four CycloneDX 1.6 files:

  • RPM artifact SBOM for x86_64
  • RPM artifact SBOM for aarch64
  • Runtime OS dependency SBOM for x86_64
  • Runtime OS dependency SBOM for aarch64

Validation

  • Focused parser/output tests were added for speculative TLS ClientHello handling, TLS version labels, unknown crypto classification, legacy codepoint translation, and offline HTTP/DNS output behavior.

Known Notes

  • The documentation site remains focused on offline mode and generated NDJSON output.

Baseline Capabilities

Version 1.0.0.0 establishes the initial sniffer baseline for offline network cryptography discovery and local NDJSON output. It provides the core runtime, configuration, capture, parsing, and output paths used by later releases.

Capture and Processing

  • Live packet capture from local interfaces.
  • Offline processing of packet capture files through .pcap, .pcapng, and file:///... inputs.
  • Configurable BPF filtering for targeted capture.
  • TCP connection tracking with source/destination address, port, byte, and packet counters.
  • Protocol classification for supported crypto and application protocols.

Offline Output

  • Offline mode for local operation without PostgreSQL connectivity.
  • ECS-style NDJSON output with one JSON object per line.
  • Configurable output path, append behavior, buffering, and per-connection flushing.
  • Circular indexed NDJSON rotation with configurable maximum file size and file count.
  • Customer and observer metadata tagging through customer_id and sniffer_id.

TLS, SSH, QUIC, and PQC Telemetry

  • TLS ClientHello and ServerHello parsing when handshake data is available.
  • TLS cipher suite, version, SNI, ALPN, supported groups, and signature algorithm telemetry.
  • SSH banner and key-exchange metadata when observed.
  • QUIC version metadata when observed.
  • PQC readiness fields under the custom pqc.* namespace.
  • Overall quantum-safety and readiness-score fields for downstream review.

Configuration and Operation

  • YAML-based configuration for sniffer identity, capture source, offline output, logging, monitoring, resource limits, and crash handling.
  • Interactive setup support for generating configuration files.
  • Configuration validation before runtime.
  • Foreground operation for first-run validation and troubleshooting.
  • Logging to local files with rotation controls.

Documentation Baseline

  • Offline-mode quick start.
  • YAML configuration reference.
  • Command reference.
  • PCAP processing guidance.
  • NDJSON output overview.
  • Rotation and retention guidance.
  • Troubleshooting and FAQ pages.

Known Notes

  • This baseline release establishes the initial documented behavior. Later releases add stricter TLS classification, expanded schema documentation, SBOM automation, containerized RPM build guidance, and generated release SBOMs.